CVE-2026-55200: Libssh2, Linux Kernel, Others — Critical Zero-Day Exploits Released (June 2026)

CVE-2026-55200 — Libssh2, Linux Kernel, and More

CVE-2026-55200 and a cluster of critical vulnerabilities (CVE-2026-58049 through CVE-2026-58593) have been publicly disclosed via the Exploitarium dump, targeting Libssh2, the Linux kernel, FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, MyBB, PHP, OpenVPN, and VLC player. These vulnerabilities enable remote code execution, privilege escalation, and authentication bypass. Several CVEs are confirmed under active exploitation; CVSS scores are critical (9.0–10.0). Some projects have released patches, but multiple zero-days remain unaddressed.

Attack Vector

Attackers leverage public proof-of-concept exploits requiring only network access or crafted payloads to trigger vulnerabilities in exposed services or client applications. For example, CVE-2026-55200 in Libssh2 allows unauthenticated remote code execution via malformed SSH packets. Exploits do not require prior authentication and can be automated for mass exploitation. No specific IOCs are provided, but exploitation attempts are observable as anomalous authentication or process crashes in affected services.

Who Is at Risk

All organizations running unpatched versions of Libssh2, Linux kernel, FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, MyBB, PHP, OpenVPN, and VLC player are at immediate risk. Both server and client deployments are vulnerable, including cloud, on-premises, and hybrid environments. Major open-source maintainers are impacted globally; exploitation is not limited to any specific region or sector.

Patch & Mitigate

• Patch: Apply the latest security updates for each affected component immediately. Monitor vendor advisories for new patches as some vulnerabilities remain unpatched as of June 2026.
• Workaround: Where patches are unavailable, restrict network access to vulnerable services and disable unnecessary components.
• Detect: Monitor logs for failed authentication attempts, unexpected service crashes, or anomalous process behavior. Review network traffic for exploit signatures and unusual SSH or application protocol activity.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit public-facing applications using released zero-day exploits.
• TA0005 — Defense Evasion: Exploits may disable or bypass security controls during execution.
• TA0007 — Discovery: Attackers may enumerate vulnerable services post-compromise to escalate access.

Source: https://www.infosecurity-magazine.com/news/researcher-exploitarium-exploits/